Security7 min read275 words
AI-generated code security: the holes we keep opening on vibe-built apps
Assistants optimise for demos that work. Attackers optimise for assumptions you never stated. These are the recurring gaps we close before launch.
Rehan Goraya
Founder & Head of Product Development · Published 15 Sept 2026
AI-written features often “work” in the happy path and fail open everywhere else. That is not a moral failing of the model — it was never asked to threat-model your product.
Across vibe-coded reviews we see the same classes of weakness. Close these early and you avoid the ugly emergency patch after someone else’s scanner finds them.
1. Secrets in the client or the repo
API keys in NEXT_PUBLIC_ vars, tokens committed to Git, and service credentials pasted into chat history still happen weekly. Move secrets server-side, rotate anything exposed, and scan the repo history.
2. Authentication without authorisation
Logged-in is not the same as allowed. Every read and write needs a server-side check that the user owns the resource — not only a hidden button in the UI.
3. Wide-open API routes
Prototype APIs often skip auth, rate limits, and input validation. Assume every route is callable directly. Validate bodies, authenticate, and throttle.
4. Injection and unsafe query building
String-built SQL, unchecked Markdown HTML, and shelling out with user input show up when models copy unsafe patterns. Use parameterised queries and strict HTML sanitisation.
5. File uploads without a muzzle
Unrestricted MIME types, executable extensions, and public buckets turn uploads into malware hosting. Limit types/sizes, scan when needed, and serve from locked-down storage.
6. Dependency sprawl
Each convenience package expands the attack surface. Audit lockfiles, remove unused modules, and keep critical packages updated on a schedule — not only when something breaks.
7. Missing baseline HTTP hardening
HTTPS redirects, secure cookies, CSRF protections for cookie sessions, and sensible security headers are boring — and missing on many AI scaffolds. Add them before public traffic.
Questions people ask
- Security
- Auth
- API
- Secrets
Written by
Rehan Goraya
Founder & Head of Product Development, Fixthevibecode
Building software products since 2019. Every enquiry is read and answered by me personally, not by a sales team.
